[heir]

OK!

Let's restore that file.


1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the codebox below into it:

DeQuarantine::
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\sysogg.dll.vir
Quit::

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\DeQuarantine_log.txt which I will require in your next reply.



Then please retry the Kaspersky Online Scan.

[Advertisements]

Hey Heir,

For some reason I cannot get the CFScript.txt file to drop onto the combofix.exe. It just pushes it aside in the grid, or if I disable align with grid, it just sits on top of it but does nothing. Is there something obvious I am not doing?

[Danneroo]

Hey Heir,

For some reason I cannot get the CFScript.txt file to drop onto the combofix.exe. It just pushes it aside in the grid, or if I disable align with grid, it just sits on top of it but does nothing. Is there something obvious I am not doing?

[heir]

Lets do it like this then

Goto Start->Run... Copy and paste this in.

ComboFix "C:\Documents and Settings\Leslie Caronia\Desktop\CFScript.txt"

Click OK

[Danneroo]

That was a clever way of doing it . Posted below is the combofix dequarantine log. I was able to begin the Kaspersky scan for the first time. It got to 11% after the first hour, but then for the next hour and a half it didn't move at all. I tried it again after that and it gave me a virtual memory warning and paused the computer. I will try again tonight. Thanks again! Danneroo

C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\sysogg.dll.vir -> C:\WINDOWS\SYSTEM32\sysogg.dll ( 25 bytes )

[heir]

If it fails.
Here is an alternative to Kaspersky Online Scanner.

Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan

• Tick the box next to YES, I accept the Terms of Use
• Click Start
• When asked, allow the ActiveX control to install
• Click Start
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
• Click Scan (This scan can take several hours, so please be patient)
• Once the scan is completed, you may close the window
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
• Copy and paste that log as a reply to this topic

[Danneroo]

Hey Heir, thanks for the alternate scanner. Kaspersky locked up on me again. Eset had an error the first time, but the second it it scanned to completion - it took a while, smiles. Below is the log:


ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=7.00.6000.17023 (vista_gdr.100222-0012)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=6068effeefb8924b8d6b09c1cb4583cf
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-04-07 08:57:21
# local_time=2010-04-07 04:57:21 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=1024 16777175 100 0 34125095 34125095 0 0
# compatibility_mode=4864 16777215 100 0 34036402 34036402 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=55308
# found=4
# cleaned=4
# scan_time=18835
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\bezogebu.dll.vir a variant of Win32/Kryptik.DNI trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\mozafije.dll.vir a variant of Win32/Kryptik.DNI trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\tifetewe.dll.vir a variant of Win32/Kryptik.DNI trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\yaruyava.dll.vir a variant of Win32/Kryptik.DNI trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

[heir]

To totally remove those objects quarantined by ESET just go to Add/Remove Programs in the Control Panel and uninstall ESET Online Scanner. (That is if you didn't tick that check-box to let it uninstall itself when finished running.)


Hey there, Danneroo !

OK! Well done, your log is clean again!

Time for some housekeeping.

Step 1.
Clean up:

We need to do is to remove all the tools that you have used. This is so that should you ever be re-infected, you will download updated versions. It will also remove the quarantined Malware from your computer.

First:

• Click START then RUN
• Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the /U, it needs to be there.
  

Second:
Double-click OTL.exe to run it.
Click the CleanUp button
Click Yes to the reboot.

Now delete any tools/logs that is left over after you ran OTL CleanUp.

Step 2.
Prevention:

OK, lets carry out a few preventative steps to make sure you reduce the risk of further infections.

First:
Your Adobe Acrobat Reader is out of date. Older versions are vulnerable to attack.

Please go to the link below to download an update.

http://www.adobe.com.../readstep2.html

Remove the older versions and install the latest,


Second:
One of the essentials is to keep your computer updated with the latest operating system patches and security fixes. Windows Updates are constantly being revised to combat the newest hacks and threats, Microsoft releases security updates that help your computer from becoming vunerable. It is best if you have these set to download automatically.

Automatic Updates for Windows

• Click Start.
• Select Settings and then Control Panel.
• Select Automatic Updates.
• Click Automatic (recommended)
• Choose a day and a time when you know the computer will be on and connected to the internet.
• Click Apply then OK.

Third:
Now lets download some preventative programs that will help to keep the nasties away! We will start with Anti Spyware programs. I would advise getting a couple of them at least, and running each at least once a month.

Anti Spyware

• SpywareBlaster to help prevent spyware from installing in the first place. A tutorial can be found here.
• SpywareGuard to catch and block spyware before it can execute. A tutorial can be found here.
• IESpy-Ad to block access to malicious websites so you cannot be redirected to them from an infected site or email.

.
Note: If you find your system slows down after installing any of these, just uninstall it, or disable it from running at startup.


Fourth:
Next lets look at Firewalls. These help to prevent unauthorised access both to and from the internet or your local network. A firewall is considered a first line of defense in protecting private information. Below are two free firewalls to choose from, if you do not already have one. Note: You only need one firewall one your system.

Personal Firewalls

• Comodo is a free fully functional firewall
• Online Armor (Free edition) personal firewall

Fifth:
On to personal Anti Virus programs.

One AV is a must have! But never more than one, as this can and will cause conflicts and false readings. I have listed three free AV's below which are as good as any paid subscription AV, as long as you allow them to update themselves.

Anti Virus Programs

• avast! Free Edition an excellent free AV.
• AVG Anti-Virus Free Edition is free for personal use.
• Avira AntiVir PersonalEdition, yet another good free AV.

Sixth:
Nearly done! If you like to use chat, MSN and Yahoo have vunerabilities that can leave you open to infections. There are however a couple of very good, Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN):

Instant Messengers

• Trillian or,
• Miranda-IM

Lastly:
It is a good idea to clear out all your temp files every now and again with ATF Cleaner. This will help your computer from bogging down and slowing. It also can assist in getting rid of files that may contain malicious code that could re-infect your computer.


To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein.


I will keep this log open for the next couple of days, so if you have any further problems post another reply here.

OK, all the best, and stay safe!

[Danneroo]

Thanks for all your help Heir. Very much appreciated! Donation on the way
-Danneroo

[heir]

Thanks will keep the topic open for a couple of days.

[heir]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.